← MCP Security Catalog

LocalStack MCP Server 0.6.0

npm · @localstack/localstack-mcp-server · latest release

Verified with no proven findings
Security result
14
Observed tools
55
Version rating
Change risk

Independent inventory

Observed 2026-08-14T08:33:40.667Z using mcpSecurity-inventory. Protocol 2025-06-18.

ToolCategoryRisk
localstack-app-inspectorQuery and manage App Inspector traces, spans, and events to review deployed LocalStack applications
Input schema
{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "type": "object",
  "properties": {
    "action": {
      "type": "string",
      "enum": [
        "get-status",
        "set-status",
        "list-traces",
        "get-trace",
        "delete-traces",
        "list-spans",
        "get-span",
        "delete-spans",
        "list-events",
        "get-event",
        "list-iam-events"
      ],
      "description": "The App Inspector action to perform. Typical debugging flow: get-status, set-status to enabled if needed, run AWS workload, list-traces, list-spans for a trace, then list-events or list-iam-events for a span."
    },
    "status": {
      "description": "Status to set. Required for set-status. Use enabled before running a workload you want to inspect.",
      "type": "string",
      "enum": [
        "enabled",
        "disabled"
      ]
    },
    "trace_id": {
      "description": "Trace ID. Required for get-trace, list-spans, get-span, delete-spans, list-events, get-event, and list-iam-events. For list-spans/list-events/list-iam-events, use '*' to query across all traces.",
      "type": "string"
    },
    "span_id": {
      "description": "Span ID. Required for get-span, list-events, get-event, and list-iam-events. For list-events/list-iam-events, use '*' to query across all spans.",
      "type": "string"
    },
    "event_id": {
      "description": "Event ID. Required for get-event.",
      "type": "string"
    },
    "trace_ids": {
      "description": "Trace IDs to delete for delete-traces. Omit to delete all traces.",
      "type": "array",
      "items": {
        "type": "string"
      }
    },
    "span_ids": {
      "description": "Span IDs to delete for delete-spans. Omit to delete all spans in the trace scope.",
      "type": "array",
      "items": {
        "type": "string"
      }
    },
    "limit": {
      "description": "Maximum number of results to return (1-1000)",
      "type": "integer",
      "minimum": 1,
      "maximum": 1000
    },
    "pagination_token": {
      "description": "Pagination cursor from a previous response",
      "type": "string"
    },
    "service_name": {
      "description": "Filter traces or spans by AWS service name, e.g. lambda, s3, sqs.",
      "type": "string"
    },
    "region": {
      "description": "Filter by AWS region (e.g., 'us-east-1')",
      "type": "string"
    },
    "account_id": {
      "description": "Filter traces or spans by LocalStack AWS account ID.",
      "type": "string"
    },
    "operation_name": {
      "description": "Filter by operation name (e.g., 'CreateBucket')",
      "type": "string"
    },
    "resource_name": {
      "description": "Filter by resource name",
      "type": "string"
    },
    "arn": {
      "description": "Filter traces or spans by resource ARN. This value is not sent to analytics.",
      "type": "string"
    },
    "parent_span_id": {
      "description": "Filter traces or spans by parent span ID.",
      "type": "string"
    },
    "status_code": {
      "description": "Filter traces or spans by status code.",
      "type": "integer",
      "minimum": 0,
      "maximum": 9007199254740991
    },
    "start_time_unix_nano": {
      "description": "Filter traces or spans by start timestamp in Unix nanoseconds.",
      "type": "integer",
      "minimum": 0,
      "maximum": 9007199254740991
    },
    "end_time_unix_nano": {
      "description": "Filter traces or spans by end timestamp in Unix nanoseconds.",
      "type": "integer",
      "minimum": 0,
      "maximum": 9007199254740991
    },
    "version": {
      "description": "Filter traces or spans by App Inspector schema version.",
      "type": "integer",
      "minimum": 0,
      "maximum": 9007199254740991
    },
    "event_name": {
      "description": "Filter events by event name.",
      "type": "string"
    },
    "event_type": {
      "description": "Filter events by event type, e.g. iam.policy_evaluation.",
      "type": "string"
    }
  },
  "required": [
    "action"
  ]
}
Annotations
{
  "title": "LocalStack App Inspector",
  "readOnlyHint": false,
  "destructiveHint": true,
  "idempotentHint": false
}
localstack-aws-clientExecutes an AWS CLI command against the running LocalStack container using the 'awslocal' wrapper.
Input schema
{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "type": "object",
  "properties": {
    "command": {
      "type": "string",
      "minLength": 1,
      "description": "The AWS CLI command to execute (e.g., 's3 ls', 'dynamodb list-tables'). Do not include 'awslocal' or 'aws'."
    }
  },
  "required": [
    "command"
  ]
}
Annotations
{
  "title": "LocalStack AWS Client"
}
localstack-aws-replicatorReplicate external AWS resources into a running LocalStack instance using the AWS Replicator HTTP API.
Input schema
{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "type": "object",
  "properties": {
    "action": {
      "type": "string",
      "enum": [
        "start",
        "status",
        "list",
        "list-resources"
      ],
      "description": "The AWS Replicator action to perform: start a job, check job status, list jobs, or list supported resource types."
    },
    "replication_type": {
      "default": "SINGLE_RESOURCE",
      "description": "Replication job type. Use SINGLE_RESOURCE for one resource, or BATCH for supported batch jobs such as SSM parameters under a path prefix.",
      "type": "string",
      "enum": [
        "SINGLE_RESOURCE",
        "BATCH"
      ]
    },
    "resource_type": {
      "description": "CloudFormation resource type to replicate, e.g. AWS::EC2::VPC or AWS::SSM::Parameter. Use this with resource_identifier, or provide resource_arn instead.",
      "type": "string"
    },
    "resource_identifier": {
      "description": "CloudControl identifier for the resource to replicate, such as a VPC ID (vpc-...), SSM parameter name, IAM role name, or ECR repository name. Required when using resource_type and mutually exclusive with resource_arn. For BATCH SSM parameter replication, this must be a path prefix such as /dev/.",
      "type": "string"
    },
    "resource_arn": {
      "description": "Full ARN of the resource to replicate. Only supported for SINGLE_RESOURCE jobs and mutually exclusive with resource_type/resource_identifier.",
      "type": "string"
    },
    "job_id": {
      "description": "Replication job id. Required for the status action.",
      "type": "string"
    },
    "target_account_id": {
      "description": "Optional LocalStack target AWS account id override. LocalStack defaults to account 000000000000, so this is only needed when replicating into a non-default account namespace.",
      "type": "string"
    },
    "target_region_name": {
      "description": "Optional LocalStack target AWS region override. Defaults to the source region.",
      "type": "string"
    }
  },
  "required": [
    "action"
  ]
}
Annotations
{
  "title": "LocalStack AWS Replicator",
  "readOnlyHint": false,
  "destructiveHint": false,
  "idempotentHint": false
}
localstack-chaos-injectorInjects, manages, and clears chaos faults and network effects in LocalStack to test system resilience.
Input schema
{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "type": "object",
  "properties": {
    "action": {
      "type": "string",
      "enum": [
        "inject-faults",
        "add-fault-rule",
        "remove-fault-rule",
        "get-faults",
        "clear-all-faults",
        "inject-latency",
        "get-latency",
        "clear-latency"
      ],
      "description": "The specific chaos engineering action to perform."
    },
    "rules": {
      "description": "An array of fault rules. Required for 'inject-faults', 'add-fault-rule', and 'remove-fault-rule' actions.",
      "type": "array",
      "items": {
        "type": "object",
        "properties": {
          "service": {
            "description": "Name of the AWS service to affect (e.g., 's3', 'lambda').",
            "type": "string"
          },
          "region": {
            "description": "Name of the AWS region to affect (e.g., 'us-east-1').",
            "type": "string"
          },
          "operation": {
            "description": "Name of the specific service operation to affect (e.g., 'CreateBucket').",
            "type": "string"
          },
          "probability": {
            "description": "The probability (0.0 to 1.0) of the fault occurring.",
            "type": "number",
            "minimum": 0,
            "maximum": 1
          },
          "error": {
            "description": "The custom error to return.",
            "type": "object",
            "properties": {
              "statusCode": {
                "description": "The HTTP status code to return (e.g., 503).",
                "type": "integer",
                "minimum": -9007199254740991,
                "maximum": 9007199254740991
              },
              "code": {
                "description": "The AWS error code to return (e.g., 'ServiceUnavailable').",
                "type": "string"
              }
            }
          }
        },
        "description": "A single rule defining a chaos fault."
      }
    },
    "latency_ms": {
      "description": "Network latency in milliseconds. Required for the 'inject-latency' action.",
      "type": "integer",
      "minimum": 0,
      "maximum": 9007199254740991
    }
  },
  "required": [
    "action"
  ]
}
Annotations
{
  "title": "LocalStack Chaos Injector",
  "readOnlyHint": false,
  "destructiveHint": true,
  "idempotentHint": false
}
localstack-cloud-podsManages remote LocalStack Cloud Pods with following actions: save, load, delete
Input schema
{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "type": "object",
  "properties": {
    "action": {
      "type": "string",
      "enum": [
        "save",
        "load",
        "delete"
      ],
      "description": "The Cloud Pods action to perform."
    },
    "pod_name": {
      "description": "The name of the Cloud Pod. This is required for 'save', 'load', and 'delete' actions.",
      "type": "string"
    }
  },
  "required": [
    "action"
  ]
}
Annotations
{
  "title": "LocalStack Cloud Pods",
  "readOnlyHint": false,
  "destructiveHint": true,
  "idempotentHint": false
}
localstack-deployerDeploys or destroys AWS infrastructure on LocalStack using CDK, Terraform, or SAM.
Input schema
{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "type": "object",
  "properties": {
    "action": {
      "type": "string",
      "enum": [
        "deploy",
        "destroy",
        "create-stack",
        "delete-stack"
      ],
      "description": "The action to perform: 'deploy'/'destroy' for CDK/Terraform, or 'create-stack'/'delete-stack' for CloudFormation."
    },
    "projectType": {
      "default": "auto",
      "description": "The type of project. 'auto' (default) infers from files. Specify 'cdk', 'terraform', 'cloudformation', or 'sam' to override.",
      "type": "string",
      "enum": [
        "cdk",
        "terraform",
        "sam",
        "auto"
      ]
    },
    "directory": {
      "description": "The required path to the project directory containing your infrastructure-as-code files.",
      "type": "string"
    },
    "variables": {
      "description": "Key-value pairs for parameterization. Used for Terraform variables (-var) or CDK context (-c).",
      "type": "object",
      "propertyNames": {
        "type": "string"
      },
      "additionalProperties": {
        "type": "string"
      }
    },
    "stackName": {
      "description": "The stack name used by CloudFormation and SAM. Required for 'create-stack'/'delete-stack' actions, and optional for SAM deploy/destroy (defaults can be inferred).",
      "type": "string"
    },
    "templatePath": {
      "description": "The local template file path used by CloudFormation and SAM. Required for 'create-stack' if not discoverable from 'directory', and optional for SAM as a template override.",
      "type": "string"
    },
    "s3Bucket": {
      "description": "S3 bucket name used by SAM deployments. If omitted, SAM can use --resolve-s3.",
      "type": "string"
    },
    "resolveS3": {
      "description": "For SAM deployments, whether to use --resolve-s3 when no s3Bucket is provided.",
      "type": "boolean"
    },
    "saveParams": {
      "description": "For SAM deployments, whether to persist resolved parameters to samconfig.toml using --save-params.",
      "type": "boolean"
    }
  },
  "required": [
    "action"
  ]
}
Annotations
{
  "title": "LocalStack Deployer",
  "readOnlyHint": false,
  "destructiveHint": true,
  "idempotentHint": false
}
localstack-docsSearch the LocalStack documentation to find guides, API references, and configuration details
Input schema
{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "type": "object",
  "properties": {
    "query": {
      "type": "string",
      "description": "The search query."
    },
    "limit": {
      "default": 5,
      "description": "Maximum number of results to return.",
      "type": "integer",
      "minimum": 1,
      "maximum": 10
    }
  },
  "required": [
    "query"
  ]
}
Annotations
{
  "title": "LocalStack Docs Search",
  "readOnlyHint": true,
  "destructiveHint": false,
  "idempotentHint": true
}
localstack-ephemeral-instancesManage cloud-hosted LocalStack Ephemeral Instances: create, list, fetch logs, and delete.
Input schema
{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "type": "object",
  "properties": {
    "action": {
      "type": "string",
      "enum": [
        "create",
        "list",
        "logs",
        "delete"
      ],
      "description": "The Ephemeral Instances action to perform."
    },
    "name": {
      "description": "Instance name. Required for create, logs, and delete actions.",
      "type": "string"
    },
    "lifetime": {
      "description": "Lifetime in minutes for create action. Defaults to the platform default when omitted.",
      "type": "integer",
      "exclusiveMinimum": 0,
      "maximum": 9007199254740991
    },
    "extension": {
      "description": "Optional extension package to preload for create action. This is passed as EXTENSION_AUTO_INSTALL.",
      "type": "string"
    },
    "cloudPod": {
      "description": "Optional Cloud Pod name to initialize state for create action. This is passed as CLOUD_POD_NAME.",
      "type": "string"
    },
    "envVars": {
      "description": "Additional environment variables to pass to the ephemeral instance (create action only).",
      "type": "object",
      "propertyNames": {
        "type": "string"
      },
      "additionalProperties": {
        "type": "string"
      }
    }
  },
  "required": [
    "action"
  ]
}
Annotations
{
  "title": "LocalStack Ephemeral Instances",
  "readOnlyHint": false,
  "destructiveHint": true,
  "idempotentHint": false
}
localstack-extensionsInstall, uninstall, list, and discover LocalStack Extensions from the marketplace
Input schema
{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "type": "object",
  "properties": {
    "action": {
      "type": "string",
      "enum": [
        "list",
        "install",
        "uninstall",
        "available"
      ],
      "description": "list = installed extensions; install = install an extension; uninstall = remove an extension; available = browse the marketplace/extensions library"
    },
    "name": {
      "description": "Extension package name (e.g. 'localstack-extension-typedb' or 'localstack-extension-typedb==1.0.0'). Required for install and uninstall actions.",
      "type": "string"
    },
    "source": {
      "description": "Git URL to install from (e.g. 'git+https://github.com/org/repo.git'). Use this instead of name when installing from a repository.",
      "type": "string"
    }
  },
  "required": [
    "action"
  ]
}
Annotations
{
  "title": "LocalStack Extensions",
  "readOnlyHint": false,
  "destructiveHint": false,
  "idempotentHint": false
}
localstack-iam-policy-analyzerConfigures LocalStack's IAM enforcement and analyzes logs to automatically generate missing IAM policies.
Input schema
{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "type": "object",
  "properties": {
    "action": {
      "type": "string",
      "enum": [
        "set-mode",
        "analyze-policies",
        "get-status"
      ],
      "description": "The action to perform: 'set-mode' to configure enforcement, 'analyze-policies' to generate a policy from logs, or 'get-status' to check the current mode."
    },
    "mode": {
      "description": "The enforcement mode to set. This is required only when the action is 'set-mode'.",
      "type": "string",
      "enum": [
        "ENFORCED",
        "SOFT_MODE",
        "DISABLED"
      ]
    }
  },
  "required": [
    "action"
  ]
}
Annotations
{
  "title": "LocalStack IAM Policy Analyzer",
  "readOnlyHint": false,
  "destructiveHint": false,
  "idempotentHint": false
}
localstack-logs-analysisLocalStack log analyzer that helps developers quickly diagnose issues and understand their LocalStack interactions
Input schema
{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "type": "object",
  "properties": {
    "analysisType": {
      "default": "summary",
      "description": "The analysis to perform: 'summary' (default), 'errors', 'requests', or 'logs' for raw output.",
      "type": "string",
      "enum": [
        "summary",
        "errors",
        "requests",
        "logs"
      ]
    },
    "lines": {
      "default": 2000,
      "description": "Number of recent log lines to fetch and analyze.",
      "type": "integer",
      "exclusiveMinimum": 0,
      "maximum": 9007199254740991
    },
    "service": {
      "description": "Filter by AWS service (e.g., 's3', 'lambda'). Used with 'errors' and 'requests' modes.",
      "type": "string"
    },
    "operation": {
      "description": "Filter by a specific API operation (e.g., 'CreateBucket'). Requires 'service'. Used with 'requests' mode.",
      "type": "string"
    },
    "filter": {
      "description": "Raw keyword filter. Only used with 'logs' mode.",
      "type": "string"
    }
  }
}
Annotations
{
  "title": "LocalStack Logs Analysis",
  "readOnlyHint": true,
  "destructiveHint": false,
  "idempotentHint": true
}
localstack-managementManage LocalStack lifecycle: start, stop, restart, or check status
Input schema
{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "type": "object",
  "properties": {
    "action": {
      "type": "string",
      "enum": [
        "start",
        "stop",
        "restart",
        "status"
      ],
      "description": "The LocalStack management action to perform"
    },
    "service": {
      "default": "aws",
      "description": "The LocalStack stack/service to manage. Use 'aws' for the default AWS emulator, or 'snowflake' for the Snowflake emulator.",
      "type": "string",
      "enum": [
        "aws",
        "snowflake"
      ]
    },
    "envVars": {
      "description": "Additional environment variables as key-value pairs (only for start action)",
      "type": "object",
      "propertyNames": {
        "type": "string"
      },
      "additionalProperties": {
        "type": "string"
      }
    }
  },
  "required": [
    "action"
  ]
}
Annotations
{
  "title": "LocalStack Management",
  "readOnlyHint": false,
  "destructiveHint": false,
  "idempotentHint": false
}
localstack-snowflake-clientExecute SQL queries and commands against the LocalStack Snowflake emulator using the Snowflake CLI (snow). Use this to run SELECT queries, DDL (CREATE/DROP), DML (INSERT/UPDATE/DELETE), SHOW DATABASES/SCHEMAS/TABLES, DESCRIBE TABLE, and any other Snowflake SQL.
Input schema
{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "type": "object",
  "properties": {
    "action": {
      "type": "string",
      "enum": [
        "execute",
        "check-connection"
      ],
      "description": "Action to perform"
    },
    "query": {
      "description": "SQL query to execute (e.g. 'SELECT * FROM mytable', 'SHOW DATABASES', 'CREATE TABLE ...'). Required when action is 'execute' and file_path is not provided.",
      "type": "string"
    },
    "file_path": {
      "description": "Absolute path to a .sql file to execute. Required when action is 'execute' and query is not provided.",
      "type": "string"
    },
    "database": {
      "description": "Snowflake database context for this query.",
      "type": "string"
    },
    "schema": {
      "description": "Snowflake schema context for this query.",
      "type": "string"
    },
    "warehouse": {
      "description": "Snowflake warehouse to use for this query.",
      "type": "string"
    },
    "role": {
      "description": "Snowflake role to use for this query.",
      "type": "string"
    }
  },
  "required": [
    "action"
  ]
}
Annotations
{
  "title": "LocalStack Snowflake Client"
}
localstack-state-managementExport, import, reset, and inspect LocalStack state using local file-based workflows on disk.
Input schema
{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "type": "object",
  "properties": {
    "action": {
      "type": "string",
      "enum": [
        "export",
        "import",
        "reset",
        "inspect"
      ],
      "description": "The local LocalStack state action to perform through the LocalStack State REST API. Use this tool for file-based state export/import workflows on disk. Use Cloud Pods instead when the user wants remote cloud-backed state snapshots."
    },
    "file_path": {
      "description": "Local file path for state export or import. Required for import. For export, defaults to ls-state-export in the MCP server working directory if omitted.",
      "type": "string"
    },
    "services": {
      "description": "Optional AWS service names for service-level granularity, such as ['s3', 'lambda'] or 's3,lambda'. Supported for export, reset, and inspect. Import restores the services contained in the state file.",
      "anyOf": [
        {
          "type": "array",
          "items": {
            "type": "string",
            "minLength": 1
          }
        },
        {
          "type": "string",
          "minLength": 1
        }
      ]
    }
  },
  "required": [
    "action"
  ]
}
Annotations
{
  "title": "LocalStack State Management",
  "readOnlyHint": false,
  "destructiveHint": true,
  "idempotentHint": false
}

Resources 0

Resource templates 0

Prompts 1

Changes from previous version

No completed comparison is available.

RiskChangeSubject
No material changes recorded.

Confirmed vulnerabilities

SeverityFindingAdvisory
No confirmed vulnerability is published for this version.

Provenance

Artifact SHA-256: bcb9e22e32e3e5b3ad7514c7188dfa2e725336f20a59b67368ddfb20a8244676

Scanner: mcp-proof-engine 0.1.0.

Let’s talk about MCP security.

Share your details and our security team will contact you.